CVE-2022-48828

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48828
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix ia_size underflow iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle. Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b Patch
https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48 Patch
https://git.kernel.org/stable/c/d2211e6e34d0755f35e2f8c22d81999fa81cfc71 Patch
https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7 Patch
https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e Patch
https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b Patch
https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48 Patch
https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7 Patch
https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
History

25 Sep 2025, 19:31

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b - () https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b - Patch
References () https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48 - () https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48 - Patch
References () https://git.kernel.org/stable/c/d2211e6e34d0755f35e2f8c22d81999fa81cfc71 - () https://git.kernel.org/stable/c/d2211e6e34d0755f35e2f8c22d81999fa81cfc71 - Patch
References () https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7 - () https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7 - Patch
References () https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e - () https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e - Patch
CWE CWE-191
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

27 Jun 2025, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/d2211e6e34d0755f35e2f8c22d81999fa81cfc71 -

21 Nov 2024, 07:34

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b - () https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b -
References () https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48 - () https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48 -
References () https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7 - () https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7 -
References () https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e - () https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: NFSD: corrija el desbordamiento insuficiente de ia_size iattr::ia_size es un loff_t, que es un tipo de 64 bits firmado. NFSv3 y NFSv4 definen el tamaño del archivo como un tipo de 64 bits sin firmar. Por lo tanto, existe un rango de valores de tamaño de archivo válidos que un cliente NFS puede enviar y que ya es mayor de lo que Linux puede manejar. Actualmente, decode_fattr4() vuelca un valor u64 completo en ia_size. Si ese valor resulta ser mayor que S64_MAX, entonces ia_size tiene un desbordamiento insuficiente. También estoy a punto de arreglar el comportamiento de NFSv3, así que detectemos el desbordamiento en la ruta del código común: nfsd_setattr().

16 Jul 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 12:15

Updated : 2025-09-25 19:31

NVD link : CVE-2022-48828

Mitre link : CVE-2022-48828

CVE.ORG link : CVE-2022-48828

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-191

Integer Underflow (Wrap or Wraparound)